exisjs 0.7.14 → 0.8.0

package/dist/server/helpers/cookie.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.serializeCookie = serializeCookie;
 exports.serializeClearCookie = serializeClearCookie;
+exports.parseCookies = parseCookies;
 function serializeCookie(name, value, options = {}) {
     const parts = [
         `${encodeURIComponent(name)}=${encodeURIComponent(value)}`,
@@ -58,4 +59,38 @@ function serializeClearCookie(name, options = {}) {
         maxAge: 0,
     });
 }
+/**
+ * Parses a Cookie header. The first occurrence of a name wins, values are
+ * percent-decoded when needed, and a malformed escape keeps the raw value
+ * rather than failing the request.
+ */
+function parseCookies(header) {
+    const out = {};
+    let start = 0;
+    const len = header.length;
+    while (start < len) {
+        let end = header.indexOf(';', start);
+        if (end === -1)
+            end = len;
+        const eq = header.indexOf('=', start);
+        if (eq !== -1 && eq < end) {
+            const key = header.slice(start, eq).trim();
+            // "__proto__" would hit the prototype setter instead of a property
+            if (key !== '' && key !== '__proto__' && out[key] === undefined) {
+                let val = header.slice(eq + 1, end).trim();
+                if (val.indexOf('%') !== -1) {
+                    try {
+                        val = decodeURIComponent(val);
+                    }
+                    catch {
+                        // keep raw value
+                    }
+                }
+                out[key] = val;
+            }
+        }
+        start = end + 1;
+    }
+    return out;
+}
 //# sourceMappingURL=cookie.js.map

package/dist/server/helpers/cookie.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../../src/server/helpers/cookie.ts"],"names":[],"mappings":";;AAEA,0CAyCC;AAED,oDAWC;AAtDD,SAAgB,eAAe,CAC7B,IAAY,EACZ,KAAa,EACb,UAAyB,EAAE;IAE3B,MAAM,KAAK,GAAa;QACtB,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;KAC3D,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACzE,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IAC3E,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;IACnE,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1D,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAExC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;YAClD,IAAI,GAAG,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;iBAC9C,IAAI,GAAG,KAAK,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;iBAC7C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;gBAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,CAAC,KAAK,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;aACtC,IAAI,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;aACjD,IAAI,CAAC,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,SAAgB,oBAAoB,CAClC,IAAY,EACZ,UAAyB,EAAE;IAE3B,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IACnD,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE;QAC/B,QAAQ,EAAE,IAAI;QACd,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QACpB,MAAM,EAAE,CAAC;KACV,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../../src/server/helpers/cookie.ts"],"names":[],"mappings":";;AAEA,0CAyCC;AAED,oDAWC;AAOD,oCA0BC;AAvFD,SAAgB,eAAe,CAC7B,IAAY,EACZ,KAAa,EACb,UAAyB,EAAE;IAE3B,MAAM,KAAK,GAAa;QACtB,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;KAC3D,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACzE,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IAC3E,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;IACnE,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1D,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAExC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;YAClD,IAAI,GAAG,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;iBAC9C,IAAI,GAAG,KAAK,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;iBAC7C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;gBAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,CAAC,KAAK,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;aACtC,IAAI,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;aACjD,IAAI,CAAC,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,SAAgB,oBAAoB,CAClC,IAAY,EACZ,UAAyB,EAAE;IAE3B,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IACnD,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE;QAC/B,QAAQ,EAAE,IAAI;QACd,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QACpB,MAAM,EAAE,CAAC;KACV,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAAc;IACzC,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAA;IACzB,OAAO,KAAK,GAAG,GAAG,EAAE,CAAC;QACnB,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACpC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,GAAG,GAAG,GAAG,CAAA;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACrC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAC1C,mEAAmE;YACnE,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChE,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC1C,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACH,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;oBAC/B,CAAC;oBAAC,MAAM,CAAC;wBACP,iBAAiB;oBACnB,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;YAChB,CAAC;QACH,CAAC;QACD,KAAK,GAAG,GAAG,GAAG,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/server/helpers/etag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"etag.d.ts","sourceRoot":"","sources":["../../../src/server/helpers/etag.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,GAAG,EACR,SAAS,cAAoB,EAC7B,IAAI,SAAK,GACR,GAAG,CA+HL;AAuCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAyB9D"}
+{"version":3,"file":"etag.d.ts","sourceRoot":"","sources":["../../../src/server/helpers/etag.ts"],"names":[],"mappings":"AAIA,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,GAAG,EACR,SAAS,cAAoB,EAC7B,IAAI,SAAK,GACR,GAAG,CA+HL;AAuCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAyB9D"}

package/dist/server/helpers/etag.js

@@ -3,9 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateETag = generateETag;
 exports.safeSanitize = safeSanitize;
 exports.nativeStringify = nativeStringify;
-const rs_1 = require("@exisjs/rs");
+const node_crypto_1 = require("node:crypto");
+// Weak ETag in the `etag` package format: length in hex plus a truncated
+// base64 SHA-1. SHA-1 is fine here; it only detects content changes.
 function generateETag(content) {
-    return (0, rs_1.generateEtag)(content);
+    if (content.length === 0)
+        return 'W/"0-2jmj7l5rsw0yVb/vlWAYkK/YBwk"';
+    const hash = (0, node_crypto_1.createHash)('sha1').update(content).digest('base64').slice(0, 27);
+    return `W/"${content.length.toString(16)}-${hash}"`;
 }
 function safeSanitize(val, ancestors = new Set(), path = '') {
     if (val === null || val === undefined)

package/dist/server/helpers/etag.js.map

@@ -1 +1 @@
-{"version":3,"file":"etag.js","sourceRoot":"","sources":["../../../src/server/helpers/etag.ts"],"names":[],"mappings":";;AAEA,oCAEC;AAED,oCAmIC;AAuCD,0CAyBC;AAzMD,mCAAyC;AAEzC,SAAgB,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAA,iBAAY,EAAC,OAAO,CAAC,CAAA;AAC9B,CAAC;AAED,SAAgB,YAAY,CAC1B,GAAQ,EACR,YAAY,IAAI,GAAG,EAAU,EAC7B,IAAI,GAAG,EAAE;IAET,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAA;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IAClD,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAA;IAEvC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAElB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,GAAI,GAAW;aAChB,CAAA;QACH,CAAC;QAED,IAAI,GAAG,YAAY,GAAG,EAAE,CAAC;YACvB,MAAM,GAAG,GAAwB,EAAE,CAAA;YACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAC3B,CAAC,EACD,SAAS,EACT,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAClC,CAAA;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;gBACvB,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,IAAI,GAAG,YAAY,GAAG,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CACvC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC,CACjD,CAAA;QACH,CAAC;QAED,IACE,GAAG,CAAC,SAAS,KAAK,UAAU;YAC5B,GAAG,CAAC,SAAS,KAAK,UAAU;YAC5B,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,UAAU;YACpC,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,UAAU;YACpC,GAAG,CAAC,SAAS,KAAK,YAAY;YAC9B,GAAG,CAAC,SAAS,KAAK,MAAM;YACxB,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,YAAY;YACtC,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,MAAM,EAChC,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrE,OAAO,OAAO,GAAG,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QAC1E,CAAC;QAED,IACE,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,SAAS;YACnC,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EACjC,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,OAAO,YAAY,CACjB,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAC/C,SAAS,EACT,IAAI,CACL,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,YAAY,IAAI,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;QAED,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QACxD,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3B,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC,CACjD,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAwB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IACE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBACrB,GAAG,KAAK,QAAQ;gBAChB,GAAG,KAAK,OAAO;gBACf,GAAG,KAAK,SAAS,EACjB,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;gBAC9C,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;gBAClE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAA;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAQ;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAA;IACvB,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC7E,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YAChB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK;oBAAE,OAAO,KAAK,CAAA;YACvE,CAAC;iBAAM,IACL,OAAO,CAAC,KAAK,QAAQ;gBACrB,OAAO,CAAC,KAAK,UAAU;gBACvB,OAAO,CAAC,KAAK,QAAQ,EACrB,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK;oBAAE,OAAO,KAAK,CAAA;YACvE,CAAC;iBAAM,IACL,OAAO,CAAC,KAAK,QAAQ;gBACrB,OAAO,CAAC,KAAK,UAAU;gBACvB,OAAO,CAAC,KAAK,QAAQ,EACrB,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,eAAe,CAAC,IAAa;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,2BAA2B;IAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,CAAA;IACxB,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IAChE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAA;IAEpD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"etag.js","sourceRoot":"","sources":["../../../src/server/helpers/etag.ts"],"names":[],"mappings":";;AAIA,oCAIC;AAED,oCAmIC;AAuCD,0CAyBC;AA7MD,6CAAwC;AAExC,yEAAyE;AACzE,qEAAqE;AACrE,SAAgB,YAAY,CAAC,OAAe;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,mCAAmC,CAAA;IACpE,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7E,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,CAAA;AACrD,CAAC;AAED,SAAgB,YAAY,CAC1B,GAAQ,EACR,YAAY,IAAI,GAAG,EAAU,EAC7B,IAAI,GAAG,EAAE;IAET,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAA;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IAClD,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAA;IAEvC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAElB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,GAAI,GAAW;aAChB,CAAA;QACH,CAAC;QAED,IAAI,GAAG,YAAY,GAAG,EAAE,CAAC;YACvB,MAAM,GAAG,GAAwB,EAAE,CAAA;YACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAC3B,CAAC,EACD,SAAS,EACT,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAClC,CAAA;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;gBACvB,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,IAAI,GAAG,YAAY,GAAG,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CACvC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC,CACjD,CAAA;QACH,CAAC;QAED,IACE,GAAG,CAAC,SAAS,KAAK,UAAU;YAC5B,GAAG,CAAC,SAAS,KAAK,UAAU;YAC5B,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,UAAU;YACpC,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,UAAU;YACpC,GAAG,CAAC,SAAS,KAAK,YAAY;YAC9B,GAAG,CAAC,SAAS,KAAK,MAAM;YACxB,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,YAAY;YACtC,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,MAAM,EAChC,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrE,OAAO,OAAO,GAAG,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QAC1E,CAAC;QAED,IACE,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,SAAS;YACnC,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EACjC,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,OAAO,YAAY,CACjB,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAC/C,SAAS,EACT,IAAI,CACL,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,YAAY,IAAI,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;QAED,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QACxD,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3B,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC,CACjD,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAwB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IACE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBACrB,GAAG,KAAK,QAAQ;gBAChB,GAAG,KAAK,OAAO;gBACf,GAAG,KAAK,SAAS,EACjB,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;gBAC9C,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;gBAClE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAA;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAQ;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAA;IACvB,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC7E,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YAChB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK;oBAAE,OAAO,KAAK,CAAA;YACvE,CAAC;iBAAM,IACL,OAAO,CAAC,KAAK,QAAQ;gBACrB,OAAO,CAAC,KAAK,UAAU;gBACvB,OAAO,CAAC,KAAK,QAAQ,EACrB,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK;oBAAE,OAAO,KAAK,CAAA;YACvE,CAAC;iBAAM,IACL,OAAO,CAAC,KAAK,QAAQ;gBACrB,OAAO,CAAC,KAAK,UAAU;gBACvB,OAAO,CAAC,KAAK,QAAQ,EACrB,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,eAAe,CAAC,IAAa;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,2BAA2B;IAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,CAAA;IACxB,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IAChE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAA;IAEpD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;AACH,CAAC"}

package/dist/server/helpers/index.d.ts

@@ -1,6 +1,7 @@
 export { normalizeIp, resolveIps, resolveProtocol, resolveHostname } from './ip';
 export { parseRawBody, parseMultipartFormData, streamMultipartUpload, } from './body-parser';
-export { serializeCookie, serializeClearCookie } from './cookie';
+export { serializeCookie, serializeClearCookie, parseCookies } from './cookie';
 export { generateETag, nativeStringify } from './etag';
 export { streamToResponse } from './stream';
+export { secureJsonParse, stripPrototype } from './json';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,MAAM,CAAA;AAEhF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAEhE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,MAAM,CAAA;AAEhF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE9E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA"}

package/dist/server/helpers/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.streamToResponse = exports.nativeStringify = exports.generateETag = exports.serializeClearCookie = exports.serializeCookie = exports.streamMultipartUpload = exports.parseMultipartFormData = exports.parseRawBody = exports.resolveHostname = exports.resolveProtocol = exports.resolveIps = exports.normalizeIp = void 0;
+exports.stripPrototype = exports.secureJsonParse = exports.streamToResponse = exports.nativeStringify = exports.generateETag = exports.parseCookies = exports.serializeClearCookie = exports.serializeCookie = exports.streamMultipartUpload = exports.parseMultipartFormData = exports.parseRawBody = exports.resolveHostname = exports.resolveProtocol = exports.resolveIps = exports.normalizeIp = void 0;
 var ip_1 = require("./ip");
 Object.defineProperty(exports, "normalizeIp", { enumerable: true, get: function () { return ip_1.normalizeIp; } });
 Object.defineProperty(exports, "resolveIps", { enumerable: true, get: function () { return ip_1.resolveIps; } });
@@ -13,9 +13,13 @@ Object.defineProperty(exports, "streamMultipartUpload", { enumerable: true, get:
 var cookie_1 = require("./cookie");
 Object.defineProperty(exports, "serializeCookie", { enumerable: true, get: function () { return cookie_1.serializeCookie; } });
 Object.defineProperty(exports, "serializeClearCookie", { enumerable: true, get: function () { return cookie_1.serializeClearCookie; } });
+Object.defineProperty(exports, "parseCookies", { enumerable: true, get: function () { return cookie_1.parseCookies; } });
 var etag_1 = require("./etag");
 Object.defineProperty(exports, "generateETag", { enumerable: true, get: function () { return etag_1.generateETag; } });
 Object.defineProperty(exports, "nativeStringify", { enumerable: true, get: function () { return etag_1.nativeStringify; } });
 var stream_1 = require("./stream");
 Object.defineProperty(exports, "streamToResponse", { enumerable: true, get: function () { return stream_1.streamToResponse; } });
+var json_1 = require("./json");
+Object.defineProperty(exports, "secureJsonParse", { enumerable: true, get: function () { return json_1.secureJsonParse; } });
+Object.defineProperty(exports, "stripPrototype", { enumerable: true, get: function () { return json_1.stripPrototype; } });
 //# sourceMappingURL=index.js.map

package/dist/server/helpers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/helpers/index.ts"],"names":[],"mappings":";;;AAAA,2BAAgF;AAAvE,iGAAA,WAAW,OAAA;AAAE,gGAAA,UAAU,OAAA;AAAE,qGAAA,eAAe,OAAA;AAAE,qGAAA,eAAe,OAAA;AAElE,6CAIsB;AAHpB,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AACtB,oHAAA,qBAAqB,OAAA;AAGvB,mCAAgE;AAAvD,yGAAA,eAAe,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAE9C,+BAAsD;AAA7C,oGAAA,YAAY,OAAA;AAAE,uGAAA,eAAe,OAAA;AAEtC,mCAA2C;AAAlC,0GAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/helpers/index.ts"],"names":[],"mappings":";;;AAAA,2BAAgF;AAAvE,iGAAA,WAAW,OAAA;AAAE,gGAAA,UAAU,OAAA;AAAE,qGAAA,eAAe,OAAA;AAAE,qGAAA,eAAe,OAAA;AAElE,6CAIsB;AAHpB,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AACtB,oHAAA,qBAAqB,OAAA;AAGvB,mCAA8E;AAArE,yGAAA,eAAe,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,sGAAA,YAAY,OAAA;AAE5D,+BAAsD;AAA7C,oGAAA,YAAY,OAAA;AAAE,uGAAA,eAAe,OAAA;AAEtC,mCAA2C;AAAlC,0GAAA,gBAAgB,OAAA;AAEzB,+BAAwD;AAA/C,uGAAA,eAAe,OAAA;AAAE,sGAAA,cAAc,OAAA"}

package/dist/server/helpers/ip.d.ts

@@ -1,5 +1,18 @@
 import type { IncomingMessage } from 'node:http';
 export declare function normalizeIp(ip: string): string;
+/**
+ * Resolves the client IP.
+ *
+ * - `trustProxy: false` -> socket address only.
+ * - `trustProxy: true`  -> trust every hop: CDN headers (CF-Connecting-IP,
+ *   True-Client-IP, X-Real-IP, X-Client-IP), else the left-most
+ *   X-Forwarded-For entry. Only safe when every request passes through a
+ *   proxy that overwrites these headers.
+ * - `trustProxy: N`     -> trust the N closest hops, counting the socket peer
+ *   (Express semantics). The client is the entry N steps back from the
+ *   socket, so values a client prepends to X-Forwarded-For are ignored.
+ *   CDN headers are not consulted, since any client can send them.
+ */
 export declare function resolveIps(raw: IncomingMessage, trustProxy: boolean | number): {
     ips: string[];
     ip: string;

package/dist/server/helpers/ip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ip.d.ts","sourceRoot":"","sources":["../../../src/server/helpers/ip.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAQ9C;AAED,wBAAgB,UAAU,CACxB,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,OAAO,GAAG,MAAM,GAC3B;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAoE/B;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,OAAO,GAAG,MAAM,GAC3B,MAAM,CAgCR;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,OAAO,GAAG,MAAM,GAC3B,MAAM,CAgBR"}
+{"version":3,"file":"ip.d.ts","sourceRoot":"","sources":["../../../src/server/helpers/ip.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAQ9C;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,OAAO,GAAG,MAAM,GAC3B;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CA+C/B;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,OAAO,GAAG,MAAM,GAC3B,MAAM,CA6BR;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,UAAU,EAAE,OAAO,GAAG,MAAM,GAC3B,MAAM,CAaR"}

package/dist/server/helpers/ip.js

@@ -13,70 +13,83 @@ function normalizeIp(ip) {
     }
     return ip;
 }
+// Env overrides are read once; process.env access is slow on the hot path.
+let envTrust;
+function envTrustsProxy() {
+    if (envTrust === undefined) {
+        envTrust =
+            process.env.TRUST_PROXY === 'true' ||
+                process.env.EXIS_TRUST_PROXY === 'true';
+    }
+    return envTrust;
+}
+function isProxyTrusted(trustProxy) {
+    return Boolean(trustProxy) || envTrustsProxy();
+}
+function firstHeader(val) {
+    const v = Array.isArray(val) ? val[0] : val;
+    if (typeof v !== 'string')
+        return undefined;
+    const t = v.trim();
+    return t === '' ? undefined : t;
+}
+/**
+ * Resolves the client IP.
+ *
+ * - `trustProxy: false` -> socket address only.
+ * - `trustProxy: true`  -> trust every hop: CDN headers (CF-Connecting-IP,
+ *   True-Client-IP, X-Real-IP, X-Client-IP), else the left-most
+ *   X-Forwarded-For entry. Only safe when every request passes through a
+ *   proxy that overwrites these headers.
+ * - `trustProxy: N`     -> trust the N closest hops, counting the socket peer
+ *   (Express semantics). The client is the entry N steps back from the
+ *   socket, so values a client prepends to X-Forwarded-For are ignored.
+ *   CDN headers are not consulted, since any client can send them.
+ */
 function resolveIps(raw, trustProxy) {
-    const isTrusted = Boolean(trustProxy) ||
-        process.env.TRUST_PROXY === 'true' ||
-        process.env.EXIS_TRUST_PROXY === 'true';
     const rawRemote = raw.socket?.remoteAddress ?? '127.0.0.1';
     const remoteAddress = normalizeIp(rawRemote);
-    if (!isTrusted) {
+    if (!isProxyTrusted(trustProxy)) {
         return { ips: [], ip: remoteAddress };
     }
-    // 1. Direct Edge & CDN client IP headers
-    const cfConnectingIp = raw.headers['cf-connecting-ip'];
-    if (cfConnectingIp) {
-        const rawVal = Array.isArray(cfConnectingIp)
-            ? cfConnectingIp[0]
-            : cfConnectingIp;
-        if (typeof rawVal === 'string' && rawVal.trim() !== '') {
-            const ip = normalizeIp(rawVal.trim());
+    const hops = typeof trustProxy === 'number' && trustProxy > 0 ? trustProxy : Infinity;
+    if (hops === Infinity) {
+        const h = raw.headers;
+        const direct = firstHeader(h['cf-connecting-ip']) ||
+            firstHeader(h['true-client-ip']) ||
+            firstHeader(h['x-real-ip']) ||
+            firstHeader(h['x-client-ip']);
+        if (direct) {
+            const ip = normalizeIp(direct);
             return { ips: [ip], ip };
         }
     }
-    const trueClientIp = raw.headers['true-client-ip'];
-    if (trueClientIp) {
-        const rawVal = Array.isArray(trueClientIp) ? trueClientIp[0] : trueClientIp;
-        if (typeof rawVal === 'string' && rawVal.trim() !== '') {
-            const ip = normalizeIp(rawVal.trim());
-            return { ips: [ip], ip };
-        }
-    }
-    const xRealIp = raw.headers['x-real-ip'];
-    if (xRealIp) {
-        const rawVal = Array.isArray(xRealIp) ? xRealIp[0] : xRealIp;
-        if (typeof rawVal === 'string' && rawVal.trim() !== '') {
-            const ip = normalizeIp(rawVal.trim());
-            return { ips: [ip], ip };
-        }
-    }
-    const xClientIp = raw.headers['x-client-ip'];
-    if (xClientIp) {
-        const rawVal = Array.isArray(xClientIp) ? xClientIp[0] : xClientIp;
-        if (typeof rawVal === 'string' && rawVal.trim() !== '') {
-            const ip = normalizeIp(rawVal.trim());
-            return { ips: [ip], ip };
-        }
-    }
-    // 2. Parse standard X-Forwarded-For proxy chain
     const xForwardedFor = raw.headers['x-forwarded-for'];
-    let ips = [];
-    if (xForwardedFor) {
-        const rawVal = Array.isArray(xForwardedFor)
-            ? xForwardedFor.join(',')
-            : xForwardedFor;
-        ips = rawVal.split(',').map((item) => normalizeIp(item.trim()));
+    if (!xForwardedFor)
+        return { ips: [], ip: remoteAddress };
+    const rawVal = Array.isArray(xForwardedFor)
+        ? xForwardedFor.join(',')
+        : xForwardedFor;
+    const forwarded = [];
+    for (const part of rawVal.split(',')) {
+        const t = part.trim();
+        if (t !== '')
+            forwarded.push(normalizeIp(t));
     }
-    let trustedIps = ips;
-    if (typeof trustProxy === 'number' && trustProxy > 0) {
-        trustedIps = ips.slice(-(trustProxy + 1));
+    if (forwarded.length === 0)
+        return { ips: [], ip: remoteAddress };
+    if (hops === Infinity) {
+        return { ips: forwarded, ip: forwarded[0] };
     }
-    const ip = trustedIps.length > 0 ? trustedIps[0] : remoteAddress;
-    return { ips: trustedIps, ip };
+    // Full chain as seen from the server: [...forwarded, socketPeer].
+    // Trusting N hops means the client sits at index (length - 1 - N).
+    const chainLen = forwarded.length + 1;
+    const clientIdx = Math.max(0, chainLen - 1 - hops);
+    const ips = forwarded.slice(clientIdx);
+    return { ips, ip: forwarded[clientIdx] };
 }
 function resolveProtocol(raw, trustProxy) {
-    const isTrusted = Boolean(trustProxy) ||
-        process.env.TRUST_PROXY === 'true' ||
-        process.env.EXIS_TRUST_PROXY === 'true';
+    const isTrusted = isProxyTrusted(trustProxy);
     const connection = raw.socket;
     const isTls = connection?.encrypted || false;
     let protocol = isTls ? 'https' : 'http';
@@ -103,9 +116,7 @@ function resolveProtocol(raw, trustProxy) {
     return protocol;
 }
 function resolveHostname(raw, trustProxy) {
-    const isTrusted = Boolean(trustProxy) ||
-        process.env.TRUST_PROXY === 'true' ||
-        process.env.EXIS_TRUST_PROXY === 'true';
+    const isTrusted = isProxyTrusted(trustProxy);
     let host = raw.headers['x-forwarded-host'];
     if (!host || !isTrusted) {
         host = raw.headers.host || '';

package/dist/server/helpers/ip.js.map

@@ -1 +1 @@
-{"version":3,"file":"ip.js","sourceRoot":"","sources":["../../../src/server/helpers/ip.ts"],"names":[],"mappings":";;AAEA,kCAQC;AAED,gCAuEC;AAED,0CAmCC;AAED,0CAmBC;AA3ID,SAAgB,WAAW,CAAC,EAAU;IACpC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACjB,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAgB,UAAU,CACxB,GAAoB,EACpB,UAA4B;IAE5B,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;QAClC,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM,CAAA;IAEzC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,WAAW,CAAA;IAC1D,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,CAAA;IACvC,CAAC;IAED,yCAAyC;IACzC,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACtD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YAC1C,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YACnB,CAAC,CAAC,cAAc,CAAA;QAClB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACrC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;QAC3E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACrC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACrC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC5C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACrC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACpD,IAAI,GAAG,GAAa,EAAE,CAAA;IACtB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YACzC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,CAAC,CAAC,aAAa,CAAA;QACjB,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,UAAU,GAAG,GAAG,CAAA;IACpB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACrD,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IAChE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;AAChC,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAoB,EACpB,UAA4B;IAE5B,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;QAClC,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM,CAAA;IAEzC,MAAM,UAAU,GAAG,GAAG,CAAC,MAEtB,CAAA;IACD,MAAM,KAAK,GAAG,UAAU,EAAE,SAAS,IAAI,KAAK,CAAA;IAC5C,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAEvC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;gBACpC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,MAAM,CAAA;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;QACxD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;gBAC7C,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC3B,CAAC,CAAC,eAAe,CAAA;YACnB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAoB,EACpB,UAA4B;IAE5B,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;QAClC,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM,CAAA;IAEzC,IAAI,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAEvC,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC"}
+{"version":3,"file":"ip.js","sourceRoot":"","sources":["../../../src/server/helpers/ip.ts"],"names":[],"mappings":";;AAEA,kCAQC;AAqCD,gCAkDC;AAED,0CAgCC;AAED,0CAgBC;AAnJD,SAAgB,WAAW,CAAC,EAAU;IACpC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACjB,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,2EAA2E;AAC3E,IAAI,QAA6B,CAAA;AACjC,SAAS,cAAc;IACrB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,QAAQ;YACN,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;gBAClC,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM,CAAA;IAC3C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,UAA4B;IAClD,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,cAAc,EAAE,CAAA;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,GAAkC;IACrD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAClB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,UAAU,CACxB,GAAoB,EACpB,UAA4B;IAE5B,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,WAAW,CAAA;IAC1D,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IAE5C,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,IAAI,GACR,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;IAE1E,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAA;QACrB,MAAM,MAAM,GACV,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAClC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAChC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC3B,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;QAC/B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;YAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACpD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,CAAA;IAEzD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,aAAa,CAAA;IACjB,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,CAAA;IAEjE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7C,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IAClD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACtC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;AAC1C,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAoB,EACpB,UAA4B;IAE5B,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;IAE5C,MAAM,UAAU,GAAG,GAAG,CAAC,MAEtB,CAAA;IACD,MAAM,KAAK,GAAG,UAAU,EAAE,SAAS,IAAI,KAAK,CAAA;IAC5C,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAEvC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;gBACpC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,MAAM,CAAA;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;QACxD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;gBAC7C,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC3B,CAAC,CAAC,eAAe,CAAA;YACnB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAoB,EACpB,UAA4B;IAE5B,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;IAE5C,IAAI,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAEvC,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC"}

package/dist/server/helpers/json.d.ts

@@ -0,0 +1,3 @@
+export declare function stripPrototype<T>(value: T): T;
+export declare function secureJsonParse<T = unknown>(text: string): T;
+//# sourceMappingURL=json.d.ts.map

package/dist/server/helpers/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../src/server/helpers/json.ts"],"names":[],"mappings":"AA2BA,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAG7C;AAED,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAM5D"}

package/dist/server/helpers/json.js

@@ -0,0 +1,43 @@
+"use strict";
+// JSON body parsing with prototype-pollution protection.
+//
+// V8's JSON.parse is ~7x faster than round-tripping through the native
+// binding (string -> serde Value -> JS object). JSON.parse never pollutes a
+// prototype by itself: "__proto__" becomes an own property. The danger is a
+// later merge (Object.assign, spread into defaults, deep merge) copying that
+// key, so we drop "__proto__" and "constructor" keys the same way the native
+// parser did. The full walk only runs when the raw text could contain either
+// key; a \u escape could spell one out, so it also triggers the walk.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripPrototype = stripPrototype;
+exports.secureJsonParse = secureJsonParse;
+const SUSPECT = /__proto__|constructor|\\u/;
+function strip(value) {
+    if (value === null || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            strip(item);
+        return;
+    }
+    if (Object.prototype.hasOwnProperty.call(value, '__proto__')) {
+        delete value.__proto__;
+    }
+    if (Object.prototype.hasOwnProperty.call(value, 'constructor')) {
+        delete value.constructor;
+    }
+    for (const k in value)
+        strip(value[k]);
+}
+function stripPrototype(value) {
+    strip(value);
+    return value;
+}
+function secureJsonParse(text) {
+    const value = JSON.parse(text);
+    if (value !== null && typeof value === 'object' && SUSPECT.test(text)) {
+        strip(value);
+    }
+    return value;
+}
+//# sourceMappingURL=json.js.map

package/dist/server/helpers/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/server/helpers/json.ts"],"names":[],"mappings":";AAAA,yDAAyD;AACzD,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;;AAmBtE,wCAGC;AAED,0CAMC;AA5BD,MAAM,OAAO,GAAG,2BAA2B,CAAA;AAE3C,SAAS,KAAK,CAAC,KAAU;IACvB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAM;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACrC,OAAM;IACR,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC,SAAS,CAAA;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,WAAW,CAAA;IAC1B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,cAAc,CAAI,KAAQ;IACxC,KAAK,CAAC,KAAK,CAAC,CAAA;IACZ,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,eAAe,CAAc,IAAY;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,KAAK,CAAC,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/server/helpers/upload-name.d.ts

@@ -0,0 +1,9 @@
+export declare function safeUploadName(fieldname: string, filename: string): string;
+export declare function safeUploadPath(destDir: string, fieldname: string, filename: string): string;
+export declare const DEFAULT_UPLOAD_LIMITS: {
+    files: number;
+    fields: number;
+    parts: number;
+    fieldSize: number;
+};
+//# sourceMappingURL=upload-name.d.ts.map

package/dist/server/helpers/upload-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-name.d.ts","sourceRoot":"","sources":["../../../src/server/helpers/upload-name.ts"],"names":[],"mappings":"AAOA,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAGD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAOR;AAGD,eAAO,MAAM,qBAAqB;;;;;CAKjC,CAAA"}

package/dist/server/helpers/upload-name.js

@@ -0,0 +1,39 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_UPLOAD_LIMITS = void 0;
+exports.safeUploadName = safeUploadName;
+exports.safeUploadPath = safeUploadPath;
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = __importDefault(require("node:path"));
+// The multipart field name and filename are client-controlled. Neither may
+// reach the filesystem as-is: "../../x" in a field name used to escape the
+// upload directory via path.join. Only a short alnum token of each survives,
+// and the random part is a UUID instead of guessable Date.now()/Math.random().
+function safeUploadName(fieldname, filename) {
+    const field = String(fieldname || 'file')
+        .replace(/[^A-Za-z0-9_-]/g, '_')
+        .slice(0, 64) || 'file';
+    const rawExt = node_path_1.default.extname(String(filename || '')).toLowerCase();
+    const ext = /^\.[a-z0-9]{1,16}$/.test(rawExt) ? rawExt : '';
+    return `${field}-${(0, node_crypto_1.randomUUID)()}${ext}`;
+}
+// Joins and verifies the result stays inside destDir
+function safeUploadPath(destDir, fieldname, filename) {
+    const root = node_path_1.default.resolve(destDir);
+    const dest = node_path_1.default.resolve(root, safeUploadName(fieldname, filename));
+    if (node_path_1.default.dirname(dest) !== root) {
+        throw new Error('Refusing to write upload outside destination directory');
+    }
+    return dest;
+}
+// Applied when a route configures no limits of its own
+exports.DEFAULT_UPLOAD_LIMITS = {
+    files: 10,
+    fields: 100,
+    parts: 200,
+    fieldSize: 1024 * 1024,
+};
+//# sourceMappingURL=upload-name.js.map

package/dist/server/helpers/upload-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-name.js","sourceRoot":"","sources":["../../../src/server/helpers/upload-name.ts"],"names":[],"mappings":";;;;;;AAOA,wCAQC;AAGD,wCAWC;AA7BD,6CAAwC;AACxC,0DAA4B;AAE5B,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,SAAiB,EAAE,QAAgB;IAChE,MAAM,KAAK,GACT,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;SACxB,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAA;IAC3B,MAAM,MAAM,GAAG,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACjE,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,OAAO,GAAG,KAAK,IAAI,IAAA,wBAAU,GAAE,GAAG,GAAG,EAAE,CAAA;AACzC,CAAC;AAED,qDAAqD;AACrD,SAAgB,cAAc,CAC5B,OAAe,EACf,SAAiB,EACjB,QAAgB;IAEhB,MAAM,IAAI,GAAG,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;IACpE,IAAI,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,uDAAuD;AAC1C,QAAA,qBAAqB,GAAG;IACnC,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,GAAG;IACX,KAAK,EAAE,GAAG;IACV,SAAS,EAAE,IAAI,GAAG,IAAI;CACvB,CAAA"}

package/dist/server/request-handler.d.ts

@@ -7,14 +7,7 @@ export declare class RequestHandler {
     private app;
     private _compiledPipeline?;
     static activeRequests: number;
-    private _reqPool;
-    private _resPool;
-    private static readonly MAX_POOL_SIZE;
     constructor(app: App<any>);
-    private _acquireReq;
-    private _acquireRes;
-    private _releaseReq;
-    private _releaseRes;
     getCompiledPipeline(): Handler[];
     inject(options: {
         method?: string;

package/dist/server/request-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-handler.d.ts","sourceRoot":"","sources":["../../src/server/request-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAChC,OAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAIzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAMvC,qBAAa,cAAc;IAWb,OAAO,CAAC,GAAG;IAVvB,OAAO,CAAC,iBAAiB,CAAC,CAAW;IACrC,OAAc,cAAc,SAAI;IAKhC,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAO;gBAExB,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;IAEjC,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,WAAW;IAOZ,mBAAmB,IAAI,OAAO,EAAE;IAoB1B,MAAM,CAAC,OAAO,EAAE;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,EAAE,GAAG,CAAA;QACV,OAAO,CAAC,EAAE,GAAG,CAAA;KACd,GAAG,OAAO,CAAC,OAAO,mBAAmB,EAAE,YAAY,CAAC;IAwF9C,mBAAmB,CACxB,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,IAAI,GACpB,IAAI;IA6BA,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI;YA2DtD,gBAAgB;YAuChB,iBAAiB;CAuChC"}
+{"version":3,"file":"request-handler.d.ts","sourceRoot":"","sources":["../../src/server/request-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAChC,OAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAIzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAMvC,qBAAa,cAAc;IAIb,OAAO,CAAC,GAAG;IAHvB,OAAO,CAAC,iBAAiB,CAAC,CAAW;IACrC,OAAc,cAAc,SAAI;gBAEZ,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;IAE1B,mBAAmB,IAAI,OAAO,EAAE;IAsB1B,MAAM,CAAC,OAAO,EAAE;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,EAAE,GAAG,CAAA;QACV,OAAO,CAAC,EAAE,GAAG,CAAA;KACd,GAAG,OAAO,CAAC,OAAO,mBAAmB,EAAE,YAAY,CAAC;IAwF9C,mBAAmB,CACxB,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,IAAI,GACpB,IAAI;IA6BA,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI;YAyDtD,gBAAgB;YAuChB,iBAAiB;CAuChC"}

package/dist/server/request-handler.js

@@ -49,37 +49,6 @@ const noop = () => {
 class RequestHandler {
     constructor(app) {
         this.app = app;
-        // ─── Object Pools ───────────────────────────────────────────────────────────
-        // Recycle ExisRequest and ExisResponse objects instead of allocating new ones
-        // per request. This dramatically reduces V8 GC pressure under high load.
-        this._reqPool = [];
-        this._resPool = [];
-    }
-    _acquireReq(rawReq, res, trustProxy, bodyLimit) {
-        const pooled = this._reqPool.pop();
-        if (pooled) {
-            return pooled.init(rawReq, res, trustProxy, bodyLimit);
-        }
-        return new request_1.ExisRequest(rawReq, res, trustProxy, bodyLimit);
-    }
-    _acquireRes(rawRes) {
-        const pooled = this._resPool.pop();
-        if (pooled) {
-            return pooled.init(rawRes);
-        }
-        return new response_1.ExisResponse(rawRes);
-    }
-    _releaseReq(req) {
-        req.cleanup();
-        if (this._reqPool.length < RequestHandler.MAX_POOL_SIZE) {
-            this._reqPool.push(req);
-        }
-    }
-    _releaseRes(res) {
-        res.req = undefined;
-        if (this._resPool.length < RequestHandler.MAX_POOL_SIZE) {
-            this._resPool.push(res);
-        }
     }
     getCompiledPipeline() {
         if (this._compiledPipeline)
@@ -87,8 +56,12 @@ class RequestHandler {
         this.app.applyBuiltins();
         if (this.app.globalMiddleware.length === 0) {
             this._compiledPipeline = [
-                (req, res) => this.app.getRouter().handle(req, res, () => {
-                    (0, middleware_1.notFound)(req, res, noop);
+                (req, res, next) => this.app.getRouter().handle(req, res, (err) => {
+                    // Route errors must reach the error handlers, not become a 404
+                    if (err)
+                        next(err);
+                    else
+                        (0, middleware_1.notFound)(req, res, noop);
                 }),
             ];
         }
@@ -209,31 +182,32 @@ class RequestHandler {
     }
     handle(rawReq, rawRes) {
         RequestHandler.activeRequests++;
-        const res = this._acquireRes(rawRes);
-        const req = this._acquireReq(rawReq, res, this.app.options.trustProxy, this.app.options.bodyLimit);
+        // Fresh objects per request. Pooling them is unsafe: a handler that is
+        // still awaiting after the client disconnects would observe the next
+        // request's data once the object is recycled. Short-lived objects are
+        // cheap for V8's young generation, so pooling buys nothing measurable.
+        const res = new response_1.ExisResponse(rawRes);
+        const req = new request_1.ExisRequest(rawReq, res, this.app.options.trustProxy, this.app.options.bodyLimit);
         res.req = req;
         res.etagEnabled = this.app.options.etag === true;
         req.log = this.app.log;
-        // Recycle objects back to pool and decrement active request counter when the response is fully done
+        // Fired by res.end()'s completion callback, or by 'close' when the
+        // client disconnects before the response finished.
         let isDone = false;
         const onDone = () => {
             if (isDone)
                 return;
             isDone = true;
-            if (RequestHandler.activeRequests > 0) {
+            if (RequestHandler.activeRequests > 0)
                 RequestHandler.activeRequests--;
-            }
-            this._releaseReq(req);
-            this._releaseRes(res);
         };
         res._onDone = onDone;
-        if (typeof rawRes.once === 'function') {
-            rawRes.once('close', onDone);
-        }
-        else if (typeof rawRes.on === 'function') {
+        // Covers clients that disconnect before res.end(); 'close' fires at most
+        // once, so a plain listener avoids the once() wrapper allocation
+        if (typeof rawRes.on === 'function')
             rawRes.on('close', onDone);
-        }
         const pipeline = this._compiledPipeline || this.getCompiledPipeline();
+        (0, middleware_1.assignRequestId)(req, res);
         this._executeWithContext(req, res, () => {
             if (this.app.hooks.request.length === 0 &&
                 this.app.hooks.response.length === 0) {
@@ -310,5 +284,4 @@ class RequestHandler {
 }
 exports.RequestHandler = RequestHandler;
 RequestHandler.activeRequests = 0;
-RequestHandler.MAX_POOL_SIZE = 2048;
 //# sourceMappingURL=request-handler.js.map